Fix possible out-of-bounds reads in modutil_count_statements

The pointer manipulation in modutil_count_statements assumed that if a
semicolon is found, it is not the last character in the buffer. It also
assumed that the buffer contained at least one readable character.

server/core/modutil.c

@@ -1018,21 +1018,25 @@ GWBUF* modutil_create_query(const char* query)
  */
 int modutil_count_statements(GWBUF* buffer)
 {
-    char* ptr = ((char*)(buffer)->start + 5);
+    char* start = ((char*)(buffer)->start + 5);
+    char* ptr = start;
     char* end = ((char*)(buffer)->end);
     int num = 1;
 
     while (ptr < end && (ptr = strnchr_esc(ptr, ';', end - ptr)))
     {
         num++;
-        while (*ptr == ';')
+        while (ptr < end && *ptr == ';')
         {
             ptr++;
         }
     }
 
     ptr = end - 1;
-    while (isspace(*ptr))
+
+    if (ptr >= start && ptr < end)
+    {
+        while (ptr > start && isspace(*ptr))
         {
             ptr--;
         }
@@ -1041,6 +1045,7 @@ int modutil_count_statements(GWBUF* buffer)
         {
             num--;
         }
+    }
 
     return num;
 }